IOC Report
file.exe

Files

File Path

Type

Category

Malicious

file.exe

PE32 executable (GUI) Intel 80386, for MS Windows

initial sample

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 3 00:01:04 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 3 00:01:04 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 3 00:01:04 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 3 00:01:04 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 3 00:01:04 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

Chrome Cache Entry: 100

ASCII text, with very long lines (570)

downloaded

Chrome Cache Entry: 101

ASCII text, with no line terminators

downloaded

Chrome Cache Entry: 102

ASCII text, with very long lines (395)

downloaded

Chrome Cache Entry: 103

ASCII text, with very long lines (522)

downloaded

Chrome Cache Entry: 104

ASCII text, with very long lines (1694)

downloaded

Chrome Cache Entry: 90

ASCII text, with very long lines (468)

downloaded

Chrome Cache Entry: 91

ASCII text, with very long lines (683)

downloaded

Chrome Cache Entry: 92

MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel

downloaded

Chrome Cache Entry: 93

ASCII text, with very long lines (5693)

downloaded

Chrome Cache Entry: 94

ASCII text, with very long lines (2907)

downloaded

Chrome Cache Entry: 95

HTML document, ASCII text, with very long lines (681)

downloaded

Chrome Cache Entry: 96

Web Open Font Format (Version 2), TrueType, length 52280, version 1.0

downloaded

Chrome Cache Entry: 97

ASCII text, with very long lines (533)

downloaded

Chrome Cache Entry: 98

ASCII text, with very long lines (755)

downloaded

Chrome Cache Entry: 99

ASCII text, with very long lines (553)

downloaded

There are 12 hidden files, click here to show them.

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\file.exe

"C:\Users\user\Desktop\file.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /F /IM chrome.exe /T

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\SysWOW64\taskkill.exe

taskkill /F /IM msedge.exe /T

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\SysWOW64\taskkill.exe

taskkill /F /IM firefox.exe /T

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\SysWOW64\taskkill.exe

taskkill /F /IM opera.exe /T

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\SysWOW64\taskkill.exe

taskkill /F /IM brave.exe /T

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --start-fullscreen --no-first-run --disable-session-crashed-bubble --disable-infobars

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=2024,i,6605478859309440277,1233847571118689499,262144 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5556 --field-trial-handle=2024,i,6605478859309440277,1233847571118689499,262144 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5596 --field-trial-handle=2024,i,6605478859309440277,1233847571118689499,262144 /prefetch:8

There are 5 hidden processes, click here to show them.

URLs

Name

IP

Malicious

https://play.google/intl/

unknown

https://families.google.com/intl/

unknown

https://youtube.com/t/terms?gl=

unknown

https://policies.google.com/technologies/location-data

unknown

https://www.google.com/intl/

unknown

https://apis.google.com/js/api.js

unknown

https://policies.google.com/privacy/google-partners

unknown

https://play.google.com/work/enroll?identifier=

unknown

https://policies.google.com/terms/service-specific

unknown

https://g.co/recover

unknown

https://policies.google.com/privacy/additional

unknown

https://support.google.com/websearch/answer/4358949?hl=ko&ref_topic=3285072

unknown

https://play.google.com/log?format=json&hasfast=true&authuser=0

142.250.186.174

https://policies.google.com/technologies/cookies

unknown

https://www.google.com/favicon.ico

216.58.206.68

https://policies.google.com/terms

unknown

https://uberproxy-pen-redirect.corp.google.com/uberproxy/pen?url=

unknown

https://www.google.com

unknown

https://play.google.com/log?hasfast=true&authuser=0&format=json

142.250.186.174

https://play.google.com/log?format=json&hasfast=true

unknown

https://www.youtube.com/t/terms?chromeless=1&hl=

unknown

https://support.google.com/accounts?hl=

unknown

https://policies.google.com/terms/location

unknown

https://policies.google.com/privacy

unknown

https://support.google.com/accounts?p=new-si-ui

unknown

https://apis.google.com/js/rpc:shindig_random.js?onload=credentialservice.postMessage

unknown

There are 16 hidden URLs, click here to show them.

Domains

Name

IP

Malicious

youtube-ui.l.google.com

142.250.185.238

www3.l.google.com

142.250.186.78

play.google.com

142.250.186.174

Details

Name:	play.google.com
IP:	142.250.186.174
TargetID:	14
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Posts data to webserver	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

www.google.com

216.58.206.68

Details

Name:	www.google.com
IP:	216.58.206.68
TargetID:	14
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Found strings which match to known social media urls	Networking
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

youtube.com

216.58.212.142

Details

Name:	youtube.com
IP:	216.58.212.142
TargetID:	14
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Found strings which match to known social media urls	Networking
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking

accounts.youtube.com

unknown

Details

Name:	accounts.youtube.com
TargetID:	14
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

www.youtube.com

unknown

Details

Name:	www.youtube.com
TargetID:	14
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Found strings which match to known social media urls	Networking
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

IPs

IP

Domain

Country

Malicious

142.250.186.78

www3.l.google.com

United States

216.58.212.142

youtube.com

United States

142.250.186.174

play.google.com

United States

142.250.185.238

youtube-ui.l.google.com

United States

192.168.2.5

unknown

unknown

216.58.206.68

www.google.com

United States

239.255.255.250

unknown

Reserved

142.250.186.142

unknown

United States

Memdumps

Base Address

Regiontype

Protect

Malicious

D50000

heap

page read and write

E51000

unkown

page execute read

EEC000

unkown

page readonly

15FE000

stack

page read and write

F7E000

stack

page read and write

17A8000

heap

page read and write

3FD0000

trusted library allocation

page read and write

17E3000

heap

page read and write

2420000

heap

page read and write

239E000

stack

page read and write

3ED1000

heap

page read and write

D14000

heap

page read and write

17A0000

heap

page read and write

17DA000

heap

page read and write

17C1000

heap

page read and write

2450000

heap

page read and write

17C8000

heap

page read and write

2570000

heap

page read and write

17C8000

heap

page read and write

15CE000

stack

page read and write

3ED1000

heap

page read and write

D14000

heap

page read and write

3ED0000

heap

page read and write

17CE000

heap

page read and write

3FD0000

trusted library allocation

page read and write

EEC000

unkown

page readonly

E50000

unkown

page readonly

17E4000

heap

page read and write

E50000

unkown

page readonly

17D5000

heap

page read and write

17DA000

heap

page read and write

D14000

heap

page read and write

15BE000

stack

page read and write

17E2000

heap

page read and write

F1C000

unkown

page read and write

17D0000

heap

page read and write

D14000

heap

page read and write

CDA000

stack

page read and write

3ED1000

heap

page read and write

17D7000

heap

page read and write

D14000

heap

page read and write

17CA000

heap

page read and write

17D5000

heap

page read and write

F24000

unkown

page readonly

E51000

unkown

page execute read

17D5000

heap

page read and write

1F9E000

stack

page read and write

F12000

unkown

page readonly

F12000

unkown

page readonly

F20000

unkown

page write copy

E30000

heap

page read and write

17D5000

heap

page read and write

2454000

heap

page read and write

FBE000

stack

page read and write

17DA000

heap

page read and write

F24000

unkown

page readonly

F1C000

unkown

page write copy

17C4000

heap

page read and write

15DB000

stack

page read and write

17D6000

heap

page read and write

D10000

heap

page read and write

15EF000

stack

page read and write

There are 52 hidden memdumps, click here to show them.